DNS Doctoring 296600

  • Permalink
  • submit to reddit
  • Email
  • Follow


Is there any way of disabling the DNS doctoring of the Pix (v 6.3). We've
just put one in on our network and created a static NAT mapping for the mail
server. If we query any DNS server on the internet from within the network
it shows as the internal address and so for a while we thought that the DNS
had gone screwy! Now it seems apparent that the Pix is intercepting the DNS
replies and changing them to the internal address.

However, there is no DNS fixup and no alias command configured and so now I
can't work out how to disable this feature.

Any ideas anyone?

Chris.



0
Reply Chris 12/19/2003 8:01:05 PM

See related articles to this posting

On Fri, 19 Dec 2003 14:01:05 -0600, Chris wrote:

> Is there any way of disabling the DNS doctoring of the Pix (v 6.3).
> We've just put one in on our network and created a static NAT mapping
> for the mail server. If we query any DNS server on the internet from
> within the network it shows as the internal address and so for a while
> we thought that the DNS had gone screwy! Now it seems apparent that the
> Pix is intercepting the DNS replies and changing them to the internal
> address.
> 
> However, there is no DNS fixup and no alias command configured and so
> now I can't work out how to disable this feature.
> 
> Any ideas anyone?
> 
> Chris.


6.3.1?  There was a bug in 6.3.1 -or- 6.3.2 that did this exact thing.
Upgrade to 6.3.3.

Rik Bain
0
Reply Rik 12/19/2003 8:24:45 PM

"Rik Bain" <rik@remove.bainz.org> wrote in message
news:pan.2003.12.19.14.24.45.39641.7601@remove.bainz.org...
> On Fri, 19 Dec 2003 14:01:05 -0600, Chris wrote:
>
> > Is there any way of disabling the DNS doctoring of the Pix (v 6.3).
> > We've just put one in on our network and created a static NAT mapping
> > for the mail server. If we query any DNS server on the internet from
> > within the network it shows as the internal address and so for a while
> > we thought that the DNS had gone screwy! Now it seems apparent that the
> > Pix is intercepting the DNS replies and changing them to the internal
> > address.
> >
> > However, there is no DNS fixup and no alias command configured and so
> > now I can't work out how to disable this feature.
> >
> > Any ideas anyone?
> >
> > Chris.
>
>
> 6.3.1?  There was a bug in 6.3.1 -or- 6.3.2 that did this exact thing.
> Upgrade to 6.3.3.
>
> Rik Bain

Yup, 6.3(1). Thanks for that. I'll upgrade on Monday.

Much appreciated Rick.

Chris.



0
Reply Chris 12/19/2003 8:54:27 PM
comp.dcom.sys.cisco 25147 articles. 24 followers. Post

2 Replies
407 Views

Similar Articles

[PageSpeed] 4/16/2014 12:20:40 PM

  • Permalink
  • submit to reddit
  • Email
  • Follow


Reply:

Similar Artilces:

DNS doctoring.
Hi all, we have a web server inside our LAN. We have PIX32 between the world and us. I know that traffic can not come from one interface and flow to the same interface (in this case the inside one) This mean that internal clients can not access web server (e.g. www.pincopallo.it) because the DNS response return an external IP but the real machine (192.168.31.26) is inside the lan. We have just insert the static and conduit statement for internet people to access our web server. static (inside,outside) IP_of_www.pincopallo.it 192.168.31.26 netmask 255.255.255.255 0 0 conduit permit tcp host ...

DNS doctoring, alias .
Does the DNS doctoring work without specifing protocols and ports or does it with them as well? Are internal DNSes needed for the doctoring to work properly or is it the same thing to have clients with external DNSes specified and answers from them are anyway translated? Alex. "AM" <am@am.am> wrote in message news:8jxZd.14401$zZ1.354966@twister1.libero.it... > Does the DNS doctoring work without specifing protocols and ports or does it with them as well? yes, you can use the alias command completly "stand-alone" look at the Cisco doc for "understanding th...

DNS Doctoring conversion?
Currently, we are using the ALIAS command for DNS doctoring to access private IP resources inside the network that are also accessed from outside the network: alias (inside) 10.y.y.249 209.x.x.35 255.255.255.255 I know that Cisco has said that they are only maintaining this command for backward compatability and recommend going to the STATIC entry. But, I am confused by this entry on how to properly implement. Any insight would help on the proper structure to continue being able to provide DNS doctoring access from the inside of the network. I am running a PIX 515 6.3(3) On Mon, 10 Nov 2...

DNS doctoring 300001
Hi, I have problem with DNS doctoring in PIX 6.3(3) I set alias command and sysopt noproxyarp inside and it doesn't work. Out customer has linux with masquarade and he has static and for outside DNS they see this domain as static IP and they can't achieve this server. Then I try set alias command. Any known bug or sth else ? Regards, grzybek ...

DNS Doctoring with PIX
I have upgraded to PIX 6.3(4) and I am trying to use the DNS command in my STATIC to access my inside server via domain name. I do not use an internal DNS server. My question is, am I missing some other command, sysopt or fixup to make this work? The static I have does work for outside-inside traffic, but still does not 'doctor' the DNS inquiries for inside use. I do have the fixup protocol dns maximum-length 512 statement. There really isn't a lot of info on using this command in a static. I know there is an alias command, but I only have one IP address that I need to...

DNS Doctoring with a cisco router
hello. I'm wondering if there's a command that is similar to the PIX firewall's ALIAS command on a Cisco Router. Can anyone help me here? Thanks, Ben On Tue, 25 Nov 2003 16:32:22 -0600, Cool Guy Bri wrote: > hello. > > I'm wondering if there's a command that is similar to the PIX firewall's > ALIAS command on a Cisco Router. Can anyone help me here? > > Thanks, > Ben According to Document 26704, NAT Frequently Asked Question, it does DNS doctoring by default. Rik Bain Thank You for your help Rik! ben! Rik Bain <rik@remove.bainz.or...

PIX DNS doctoring with 2003 server
A quick question guys. I recently put a few firewalls in a customer premises with a static NAT policy. Internally the clients were 192.168.1.x but extrenally they were 135.1.1.x statically mapped one for one. DNS always worked ok since there were no servers on these sites - I accepted the limitaion that the machines cannot ping by machine name. This worked loads of times. I then had another site exactly like this but had a server as well as just client PC's. The clients could not get their drive mappings on this server until I clicked the DNS option against the static transatio...

Dns doctoring/dnsmasq -V on bind?
Hi, After googeling a lot I kinda gave up and ended here. Im running a bind server, where we have out .loc zone on and also use it for caching. We have our domains hosted @ our ISP's DNS-Servers. Now recently management decided to migrate from cisco to linux-routers/firewalls. Now as you might know, there is a dns-doctoring feature on cisco devices, that will rewrite ip addresses in dns-query-responses. I found a nice non-cisco explanation by someone who had my problem some years ago: > My dns server sits outside my firewall on the internet and answers queries for bo...

DNS Reply Modification (doctoring) intermittently failing
We have the following configuration that requires DNS reply modification: 1) Cisco FWSM at version 2.3.1.3 2) Firewall directly connected to our ISP. 3) A DMZ (webDMZ) containing the web servers to be doctored 4) Hosts and internal DNS server on the Inside 5) ISP dns server The internal clients (4) resolve the web server addresses (3) through the internal DNS server (4) which pulls the DNS data from the external DNS server (5). The FWSM (1) is configured to do the DNS reply modification to provide the internal clients (4) with the private webDMZ address. Outside clients obtain the public NA...

Re: AW: AW: Dns doctoring/dnsmasq -V on bind?
77u/RG5pYSAyMDExLTAxLTE3IDE1OjUzIHNvbWVvbmUgbmFwaXNhxYIoYSk6Cgo+SWYgaXQgKmlz KiB0aGUgb25seSB3YXkuLi4KPkl0IHdpbGwgcmVzdWx0IGluIGEgdG91Z2ggd2Vlay4uLgo+Tm90 IHdoYXQgSSB3YW50ZWQgdG8gaGVhciBpbmRlZWQgOykKCk1heWJlIGhhdmluZyBhIHpvbmUgZmls ZSBmb3IgZXh0ZXJuYWwgdmlldywgYW5kIHNlZCdpbmcgdGhlIElQcyB0byBnZXQgZmlsZSANCmZv ciBpbnRlcm5hbCB2aWV3IHdvdWxkIGdldCB5b3UgYW4gZWFzaWVyIHRvIG1haW50YWluIHNvbHV0 aW9uPyBZb3Ugc3RpbGwgDQpoYXZlIHRvIHNldHVwIHZpZXdzLCBidXQgdGhlbiBpdCB3aWxsIGJl IGVhc2llciB3aGVuIHlvdSBjaGFuZ2Ugc29tZXRoaW5nLgpUb3JpbnRoaWVsCgoKPgo+VHkuCj4K Pgo+LS0tLS1VcnNwcsO8bmdsaWNoZSBOYWNocmljaHQtLS0tLQo+Vm...

Pix 515 version upgrade from 6.2(2) to 6.3(4) causes DNS doctoring to stop working
I was hoping someone could help me with this. I've searched through the Cisco website to no avail. I upgraded the IOS version on my Pix 515 from 6.2(2) to 6.3(4) as this version supports VOIP better. After the upgrade was complete, the Aliases that I had setup to perform some DNS doctoring stopped working. Does anyone have any idea why? I've searched through all the release notes for 6.3(4) and all version between that and 6.2(2). Nothing in those notes is of any help. Thanks, In article <1113404624.304725.236260@g14g2000cwa.googlegroups.com>, Hoopsdfw <gareth_hoope...

Doctor, Doctor...
Given there has uncharacteristically been no post here from Doc Dwarf for nearly 4 weeks, and he is (also uncharacteristically) not responding to private mail, there seems to be some reason for concern. He did mention some health problems a little while ago. Doc, if you are seeing this, please know you are missed here and (if it is appropriate) every wish for a speedy recovery. Pete. -- "I used to write COBOL...now I can do anything." On 8/24/2011 6:42 PM, Pete Dashwood wrote: > Given there has uncharacteristically been no post here from Doc Dwarf for > nearly 4 wee...

DNS, IS THERE A SCHEME DNS REPLACEMENT?
? gavino skrev: > ? No. -- Jens Axel S�gaard On Sun 06 Aug 2006 13:05, "gavino" <bootiack@yahoo.com> writes: > ? What do you mean by replacement? There is a DNS client library and a DNS server for scsh. -Eric -- "Excuse me --- Di Du Du Duuuuh Di Dii --- Huh Weeeheeee" (Albert King) Eric Knauel wrote: > On Sun 06 Aug 2006 13:05, "gavino" <bootiack@yahoo.com> writes: > > > ? > > What do you mean by replacement? > > There is a DNS client library and a DNS server for scsh. > > -Eric there is a dns serv...

securing dns against dns attack
hello; my network has been under a dns attack for several days. i have secured all dns severs with the following globals options: allow-transfer { 204.238.34.200; 204.238.34.206; }; allow-query { 204.238.34.0/24; }; allow-recursion { 204.238.34.0/24; }; i have also configured two more dns name servers to basically absorb the attack. absorbing the dns attack does nothing to reclaim the bandwidth used by the attack. currently, my network address block, is being dropped. before i bring the network address block back up i would like to know of any other...

DNS server having DNS server
Scenario: Computer A: doesn't have bind installed. Its DNS points to computer B. Computer B: has bind installed, is a valid DNS server, has its DNS server set to PC C. Computer C:has bind, is a valid DNS server, on another network somewhere. If B does a query for hetzner.co.za, it asks C to do this. Heres the question: A asks for hetzner.co.za, B gets the query, does it do the look-up or does it defer it to C? In article <bnjkon$2ut8$1@sf1.isc.org>, shaun bugler <sb@hetzner.co.za> wrote: >Scenario: >Computer A: doesn't have bind installed. Its DNS p...

[DNS] Dns cache type
Hi, Does anyone have any idea what kind of algorythms we can use to discard = DNS cache and how to specify it? Thx. Cordialement Jeremy MAURO -- Jeremy MAURO Email: mailto:jeremy.mauro@wanadooportails.com --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.572 / Virus Database: 362 - Release Date: 27/01/2004 =20 ...

dns
I've broken DNS but I'm working on fixing it. BA ...

DNS
Heres my situation.. I've got someurl.com being pointed to my ip thanks to dyndns.org.. This was all fine and dandy until switching from cable to dsl. Heres why: We have a linksys wireless router - with no configuring to be done on the cable modem I simply forwarded my port 80 to the routers port 80... Now, after adding dsl, they gave us this speedstream 5200 dsl modem. It has more configuration options than the router. But even with the firewall on the modem dropped and a DMZ set up pointing to the linksys ( and of course my hardwired server port 80 pointing to 80 on the linksys) I can ...

DNS
Hi, Does any version of VxWorks support DNS with SRV, NAPTR, AAA and A6 queries? Also Supports all transports i.e., SIP, TCP, UDP? support both IPv4 and IPv6? rgds, Prince ...

DNS
Is there a way to make HP3000 (MPE 6.0) networking look first in HOSTS, then fail over to the nameserver(s) specified in RESLVCONF? =20 My understanding is simply NO, but I'm hoping for an easy migration to all-external DNS... =20 Tracy Pierce * To join/leave the list, search archives, change list settings, * * etc., please visit http://raven.utc.edu/archives/hp3000-l.html * --- Tracy Pierce <TPierce@goldengate.org> wrote: > Is there a way to make HP3000 (MPE 6.0) networking look first in > HOSTS, then fail over to the nameserver(s) specified in > RESLVCO...

DNS
Guys, At home, I want to have a DNS server with the domain www.testdomain.com.au It will resolve all internal DNS queries on my internal nework. Does this mean it is a primary DNS for the zone www.testdomain.com.au? If that is so, and I want all internal clients to be able to browse the web, do I set up on my DNS server (Windows 2000), a primary DNS zone, where my primary DNS/SOA is my internal DNS, and have it forward all internet queries to my ISP DNS Server? Does the ISP DNS server become my secondary DNS Server if I forward DNS queries to it, or is it just set up as a forwarder?...

DNS
Anybody says how I may query a DNS server? (the port it's 53 ??) I must programming with java. thank's Max ...

DNS
I am looking to create an application which will sit in between the browser (IE/Firefox/Opera) and the Windows resolver. Can you all point me in the direction I should go because I cannot find any documentation on this subject. Thanks for any help you can provide. ...

DNS
Hi, Recently, i have installed Microsoft DNS Server and i've taken off NetBios from all computers... so by now, the computers has as primary DNS server the ip of my DNS Server but they dont appear on the Network tree. (net view) Regards. ...